IAB: New Privacy Regulation Proposal In House Is 'Mixed Bag'

• Comment
• Recommend (8)
• Tweet
• 

Privacy legislation introduced on Monday by Rep. Bobby Rush (D-Ill.), chairman of the consumer protection subcommittee, is a "mixed bag" for the online ad industry, says Interactive Advertising Bureau Vice President of Public Policy Mike Zaneis.

Zaneis says that one way Rush's bill marks an improvement on a draft floated in May by Rep. Rick Boucher (D-Va.) is that Rush's proposal gives greater deference to the industry's self-regulatory program. At the same time, Zaneis says the industry has concerns about other terms of Rush's proposal, including one that could leave companies that violate the bill liable for up to $5 million.

"There are some provisions you really have to applaud Chairman Rush for including," Zaneis says. "The recognition that self-regulation can work is gratifying, given the work we've put into it."

Rush's proposal would regulate online behavioral targeting -- or tracking people online in order to serve them targeted ads -- by requiring companies to obtain users' consent before sharing their "personal data" with third parties. The data covered by his proposal includes names and addresses as well as some so-called "anonymous" information, like clickstream information that is used to create marketing profiles.

The proposed bill says that companies must obtain users' explicit consent, unless those companies comply with an industry self-regulatory program that offers consumers a way to opt out of all behavioral targeting.

By contrast, Boucher's draft proposal would require ad networks that track people and collect personal information for ad purposes to obtain users' opt-in consent, unless the networks provide prominent notice through an icon and allow people to view and edit their profiles.

Zaneis says that the self-regulatory carve-out in Rush's measure is "a giant step in the right direction," but questioned why the bill requires companies that don't participate in the program to obtain users' explicit consent. "If Chairman Rush believes that opt-out is the right standard for consumers when information is transferred to third parties, why don't we just codify that standard?" Zaneis asks.

In addition, Zaneis questioned whether it made sense to enshrine into law a universal opt-out, such as the one offered through the Network Advertising Initiative. "The FTC hasn't said that a universal opt-out is necessary," Zaneis says. "It's nice to have things like an NAI opt-out, but fundamentally flawed to say that you have to have a universal opt-out."

Another area of concern to the IAB is that Rush would allow consumers to sue for up to $1,000 per violation, with a cap of $5 million. Companies would be protected from suit if they participate in a self-regulatory program and universal opt-out. But it's not clear from the proposal what would happen in the event of an unintentional glitch, such as a broken opt-out link.

"The private right of action is problematic," Zaneis says. "The penalties are exorbitant."

Privacy advocates reacted to Rush's proposal more favorably than to Boucher's, which would have banned all private lawsuits.

Rush's proposal also tasks the Federal Trade Commission with promulgating a host of rules that would further refine the measure. Some advocates had expressed concern that Boucher's bill would prevent the FTC from issuing stricter standards in the future.

"I think we're cautiously optimistic that the Rush bill sets the stage for a much more powerful privacy proposal to emerge that protects consumers, but allows online advertising to flourish," says Jeff Chester, executive director of the Center for Digital Democracy.

But, he says, consumer groups still want to see a proposal that would "place some serious constraints on how online and offline marketers can harvest data for profiling without consumer control."

• Comment
• Recommend (8)
• Tweet
• 

Be the first to comment on "IAB: New Privacy Regulation Proposal In House Is 'Mixed Bag'"

Leave a Comment